PocketWealth ("we", "us", "our") is a UK-based micro-savings service operated under the trading name PocketWealth from the United Kingdom. Contact: hello@pocketwealth.uk.

We are the "data controller" for the personal data described below under the UK GDPR and the Data Protection Act 2018.

• Account data: email, display name, phone number (if provided), age confirmation.
• Money data: pot balances, top-ups, round-ups, simulated transactions and yield history.
• Sparkles chat: your messages to our AI companion and its replies, plus internal reasoning we log for safety and quality.
• Device & security data: IP address, device type, session tokens, bot-verification signals (Cloudflare Turnstile).
• Support signposting preference: your opt-in choice to see free UK money-help links inside Sparkles.

We do not hold real bank account credentials. Payments are handled by Stripe, and any future Open Banking integration will use FCA-authorised providers under a separate consent flow.

• Contract: to run your account, hold your balances and process top-ups.
• Legal obligation: to keep records, meet anti-fraud and (where applicable) FCA / HMRC obligations.
• Legitimate interests: to keep the service safe, prevent abuse, improve Sparkles, and send essential service updates.
• Consent: for optional marketing emails, support-signposting inside Sparkles, and any biometric unlock you enable on your device.

Your prompts and Sparkles' replies are stored against your account so you can revisit threads. They are processed via our AI gateway to generate responses, and we run an automated compliance check on Sparkles' replies to flag anything that could look like regulated financial advice (see our Regulatory & Risk page).

We do not use your Sparkles chats to train third-party foundation models. Model providers may retain prompts for a short abuse-detection window under their own terms.

• Lovable Cloud — hosting, database, auth (backed by Supabase in the EU/UK region).
• Stripe Payments Europe Ltd — card processing for top-ups and Sparkles Pro.
• Cloudflare — DDoS protection and Turnstile bot verification.
• Resend / email provider — transactional emails from notify.pwai.uk.
• AI model providers via our AI Gateway — to generate Sparkles replies.

We do not sell your personal data. Transfers outside the UK are covered by the UK International Data Transfer Agreement or the EU Standard Contractual Clauses plus the UK Addendum.

• Account and money records: while your account is open, then up to 6 years for tax and dispute purposes.
• Sparkles chat threads: until you delete them, then removed within 30 days.
• Security logs & compliance flags: 12 months.
• Marketing preferences: until you withdraw consent.

Under UK GDPR you can ask us to:

• Access a copy of your data.
• Correct anything inaccurate.
• Delete your account and data (subject to legal retention).
• Restrict or object to certain uses.
• Port your data to another service.
• Withdraw consent at any time.

Email privacy@pocketwealth.uk and we'll respond within one month. If you're unhappy, you can complain to the Information Commissioner's Office (ICO).

We use strictly necessary cookies for sign-in, session security and Cloudflare Turnstile. We do not use third-party advertising cookies. Any product analytics is aggregated and does not identify you individually.

PocketWealth is intended for people aged 18 or over. Onboarding requires an age confirmation and we don't knowingly collect data from under-18s.

If we suffer a personal-data breach that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and contact affected users promptly.